This security advisory covers multiple vulnerabilities affecting Red Hat AI Inference Server 3.2.5 (ROCm) and related products. Among these, CVE-2025-22868 is a significant vulnerability in the golang.org/x/oauth2/jws package where the token parsing logic uses strings.Split(token, ".") to split JWT tokens. This can be exploited by sending tokens with an excessive number of '.' characters, causing high memory consumption and potential denial of service. The advisory lists a total of 11 CVEs including CVE-2025-9230 but does not specify detailed technical information for all. No official fix has been released yet. The vendor recommends pre-validating inputs to mitigate the risk. The advisory is identified as RHSA-2025:23449 and covers multiple Red Hat products and versions.

The primary impact is denial of service caused by memory exhaustion when processing maliciously crafted tokens in the golang.org/x/oauth2/jws package. This can disrupt availability of the affected Red Hat AI Inference Server and related components. No confidentiality or integrity impacts are explicitly stated. There are no known exploits in the wild at this time.

No official fix is currently available for these vulnerabilities. Red Hat recommends pre-validating any payloads passed to the go-jose library to ensure they do not contain an excessive number of '.' characters, which can help mitigate the denial of service risk. Customers should monitor Red Hat advisories for updates and apply fixes once released. Additional mitigations should be based on vendor guidance as it becomes available.